Re: Reporting My own IP?

I am sure it helped that I added my servers to the Mailhosts lists area.
Thank you for your assistance on this.  We have lots of resources and good
minds.   If you ever need any thing please feel free to drop in and ask for
it or visit.  Best place to find us is on our private IRC server in the
#Public channel on DMIndustries.net or use the cgi chat on
http://Chat.Dangerous-Minds.NET

Now, I am going to write what I will be calling a local RBL that will build
a local list of IP's to exclude from eMail via spam collecting addresses.  I
hope that this will help cut down the spam even more.

.. Master Merlin Cul Kirkpatrick

"Mike Easter" <[email protected]> wrote in message
news:[email protected]...
> The Father Mind of DM Industries wrote:
> > Okay so now that we have more or
> > less established there is a problem with the parser, what now?
>
> It now appears to be fixed.
>
> Sometimes I think that when we are discussing what is wrong with the
> parser, Julian is lurking in the ng and tweaking code down there in the
> dungeon or wherever he does that stuff.
>
> It appears that the parser is all better.  I just forged an item to test
> an item very similar to the one we were discussing which parses
> correctly now, except that the .br IP I made up /isn't/ listed in the
> CBL, and SC now gets it right anyway.
>
> http://www.spamcop.net/sc?id=z743280656z9b76c1afbc70fc2bed3634ca9d8acdc4z
>
> So, now when SC sez 'looks like a forgery' - it makes sense.  The
> 'forgery' is comparing the 'from' IP with the domainname of the 'by'
> field -- which doesn't 'compute' - so the 'by' must be 'forged'.  Here's
> the pertinent section.   And, SC doesn't 'jump backwards' and 'unaccept'
> something which it had already accepted earlier
>
> <snip>
> Received:  from 201-26-32-156.dsl.telesp.net.br
> (201-26-32-156.dsl.telesp.net.br [201.26.32.156]) by
> server-03.dmindustries.net (Postfix) with SMTP id 500211445B for <x>;
> Wed, 16 Mar 2005 15:36:35 -0800 (PST)
> 201.26.32.156 found
> host 201.26.32.156 (getting name) = 201-26-32-156.dsl.telesp.net.br.
> 201-26-32-156.dsl.telesp.net.br is 201.26.32.156
> 64.81.88.120 not listed in dnsbl.njabl.org
> 64.81.88.120 not listed in cbl.abuseat.org
> 64.81.88.120 not listed in dnsbl.sorbs.net
> 64.81.88.120 is not an MX for babcomm.totalsystemcontrol.com
> 64.81.88.120 is an MX for server-03.dmindustries.net
> Possible spammer: 201.26.32.156
> 201.26.32.156 is not an MX for 201-26-32-156.dsl.telesp.net.br
> host 201-26-32-156.dsl.telesp.net.br (checking ip) = 201.26.32.156
> host server-03.dmindustries.net (checking ip) = 64.81.88.120
> 64.81.88.120 not listed in dnsbl.njabl.org
> 64.81.88.120 not listed in cbl.abuseat.org
> 64.81.88.120 not listed in dnsbl.sorbs.net
>    Chain test:server-03.dmindustries.net =? server-03.dmindustries.net
>    server-03.dmindustries.net and server-03.dmindustries.net have same
> hostname - chain verified
> Possible relay: 64.81.88.120
> 64.81.88.120 not listed in relays.ordb.org.
> 64.81.88.120 has already been sent to relay testers
> Received line accepted
>
> <ME: the acceptance of that line means that 64 isn't the source anymore,
> now the new potential source is 201>
>
> Received:  from ms-smtp-05.texas.rr.com ([24.93.47.44]) by
> mx3.charta2N.ca (iPlanet Messaging Server 5.2 Patch 2 (built Jul 14
> 2004)) with ESMTP id <[email protected]> for x (ORCPT x);
> Wed, 16 Mar 2005 15:23:52 -0800
> 24.93.47.44 found
> host 24.93.47.44 = ms-smtp-05.texas.rr.com (cached)
> ms-smtp-05.texas.rr.com is 24.93.47.44
> 201.26.32.156 not listed in dnsbl.njabl.org
> 201.26.32.156 not listed in cbl.abuseat.org
> 201.26.32.156 not listed in dnsbl.sorbs.net
> 201.26.32.156 is not an MX for server-03.dmindustries.net
> 201.26.32.156 is not an MX for 201-26-32-156.dsl.telesp.net.br
> 201.26.32.156 is not an MX for mx3.charta2N.ca
> 201.26.32.156 is not an MX for server-03.dmindustries.net
> 201.26.32.156 not listed in dnsbl.njabl.org
> Possible spammer: 24.93.47.44
> host mx3.charta2N.ca (checking ip) ip not found ; mx3.charta2N.ca
> discarded as fake.
> 24.93.47.44 is not an MX for mx3.charta2N.ca
> 201.26.32.156 is not an MX for mx3.charta2N.ca
>
> <ME: in that blob, SC is finding out that it can't chain from the 201
> 'from' to its respective 'by' -- and so it breaks the chain.  It also
> isn't listed in any proxy db/s, but that doesn't matter, SC figgered it
> out anyway.
>
> Looks like a forgery
> Tracking message source: 201.26.32.156:
>
> <ME: SC has the source and it didn't jump backwards to the 64, which was
> crazy before>
>
>
>
> -- 
> Mike Easter
> kibitzer, not SC admin
>